Fool an ML intrusion detector while a water tank overflows
Loading the plant.
A PLC keeps the level in tank T-101 between 0.60 m and 1.10 m. It reads the level from transmitter LT-101 over Modbus/TCP. An attacker inline on the field cables rewrites the replies from LT-101 and from valve positioner ZT-102 before they reach the PLC. A machine-learning intrusion detector watches a mirror of the PLC's network port. Every 10 s, it scores the last 60 s of traffic.
Crude attack. The level reading jumps and freezes, and the forged replies arrive late. The detector alarms within seconds.
Stealthy attack. At full stealth, the attacker simulates a copy of the tank and reports the copy's level and valve position with normal sensor noise. The copy follows the plant equation, and its valve opens to full demand at the real actuator's speed, so its level never reaches the pump-off setpoint. The PLC keeps the pump running. The real tank overflows while the detector stays below its alarm threshold of 1.00. Settings between the slider ends blend the simulated readings with a slowly growing level offset.
Physics check. Flow meters FT-101 and FT-102 measure water in and water out. Both are hardwired to a logger the attacker cannot reach. Over 5 minutes, water in minus water out must equal the volume change calculated from the reported level. A gap above 10 L for 5 s raises an alarm and trips the pump. This threshold is about 3.5 times the largest gap in 4 simulated days of normal operation (2.9 L).
An autoencoder (15 → 24 → 6 → 24 → 15) runs in your browser. It was trained on 12 simulated days of normal operation, and its alarm threshold was set on 4 held-out days before it saw any attack. Its features per 60 s window are: level mean, noise, slope and largest step; pump duty and switches; valve mean, noise and slope; transmitter response time mean and spread; packet rate; writes; the ratio of input-register (FC04) reads to packets; and the difference between the reported level slope and the slope the plant equation predicts from the reported pump and valve.
The plant is simulated from textbook physics: a tank 0.80 m across and 1.60 m tall, a 1.2 L/s pump, and an outlet valve that drains by Torricelli's law. The stealthy attacker knows the plant model and can rewrite the replies of the level transmitter and the valve positioner. It cannot reach the hardwired flow meters; an attacker that also controls those meters needs a different defense. The page keeps the downstream demand on outlet valve V-102 below 68 % of the valve's range, because at full demand the valve drains water faster than the pump supplies it and no attack can overflow the tank.
Built by JR (University of Freiburg and Hochschule Offenburg), who researches adversarial machine learning for industrial intrusion detection. Reflections: “Peppermint Powerplant 2” by Andreas Mischok, Poly Haven, CC0. The lab runs offline, and no data leaves your browser.
This lab needs WebGL. The detector and the timeline still run; the 3D plant view is off.